Summary
cnix—short for Corbet Nix—is a knowledge compiler for a suite of Nix projects. It keeps durable technical memory, explains the projects to potential users, audits documentation against implementation evidence, and safely emits a public website from an Obsidian-readable Markdown corpus.
Why it exists
The suite contains enough applications and modules that discovery becomes a problem even for its authors. cnix makes the index as valuable as the articles: it should answer what exists, why it matters, how mature it is, and where to look next before a reader opens a detailed page.
The same work serves five purposes:
- Preserve working knowledge for humans and agents.
- Explore a contemporary, LLM-led form of enterprise architecture.
- Present reusable mechanisms so others can request or contribute packaging.
- Reveal cruft, stale claims, edge cases, and implementation defects.
- Demonstrate the method itself as a public, inspectable product.
Product boundary
cnix owns authored explanations, public tutorials, provenance, verification, publication policy, and a read-only view of related work. It does not own the declared architecture or become a ticket database.
- Nix repositories remain authoritative for implementation and public options.
- A private parent workspace remains authoritative for real configuration and private tasks.
- GitHub issues and pull requests remain authoritative for public contribution work.
- A future nixea product may derive architecture directly from Nix source. cnix and nixea will share stable project identifiers and links, not copied facts or build dependencies.
Related project boundaries
Each row states what one project owns and which complementary projects cover the adjacent scope. Source links pin the exact public revision the row was read from. Rows reference revision-addressed evidence only; projects without a cnix concept yet are named here solely to delimit ownership, not as published documentation.
| Category | Project | Owns | Complementary projects | Source (public rev) |
|---|---|---|---|---|
| workload substrate | nixpods | Single-host Podman workloads: containers, pods, networks, volumes rendered at build time to real systemd units | nixk3s (cluster orchestration), nixvm (kernel-isolated guests), nixlxc (OS containers), nixdocker (docker-socket workflows) | https://git.corbet.ch/corbet-nix/nixpods-corbet-ch.git @ 2d61c3a0a933105816aad5040b0ee4a9b90e6e5f |
| workload substrate | nixvm | libvirt/QEMU-KVM host stance plus guest definitions as data (define/autostart only, never power state) | nixpods/nixdocker/nixlxc (single-host containers), nixk3s (cluster workloads), plus ephemeral test virtual machines | https://git.corbet.ch/corbet-nix/nixvm-corbet-ch.git @ 2eac28a9be1eb89ec287faf745bea1c711c3141d |
| workload substrate | nixlxc | Which LXC containers exist, rootfs/idmap/autostart, each container’s own mount table | nixstorage (datasets), nixshare (network export), host-identity (uid/gid) management, nixk3s/nixvm/nixpods (peer substrates) | https://git.corbet.ch/corbet-nix/nixlxc-corbet-ch.git @ 6691e456410a8bccd43607a3ccd3dd635da5939a |
| workload substrate | nixdocker | Digest-pinned docker containers as foreground docker run units plus the dockerd daemon surface | nixpods (daemonless servers), nixk3s (cluster services), nixlxc (OS containers), nixvm (full VMs) | https://git.corbet.ch/corbet-nix/nixdocker-corbet-ch.git @ 0d0c301ba104377589b03474d106fabd7d79eae9 |
| workload substrate | nixk3s | Cluster orchestration: k3s host, declarative app grammar, tenancy, addressing guard, GitOps spine; nothing about app kinds | nixpods/nixdocker/nixlxc (single-host containers), nixvm (full VMs, peers not layers) | https://git.corbet.ch/corbet-nix/nixk3s-corbet-ch.git @ bd64e77e2e5b29172f7f7230be0ed4e67c45dffd |
| storage | nixstorage | Local substrate model: disk table, partition layout, dataset shape, delivery categories, reconciliation, scrub; never mounts, exports, backs up, or boots | host identity (uid/gid), nixshare (sharing), nixvault (DR copies), nixnas (appliance) | https://git.corbet.ch/corbet-nix/nixstorage-corbet-ch.git @ f0e6034884839d078ff941b2ad117005fe2b6ec9 |
| storage | nixvault | Passphrase-only per-host disaster-recovery vault (LUKS→f2fs) plus cluster web/video archives; the f2fs recipe arrives as library data only | nixstorage (live layout), nixshare (sharing), nixnas (appliance) | https://git.corbet.ch/corbet-nix/nixvault-corbet-ch.git @ 7c147fbb12a235b08cd2351fff296d59d6f1394c |
| storage | nixshare | NFS/CIFS share definitions over network peer names, stuck-automount watchdog, server-side NFS/Samba exports; no address resolution | nixstorage (datasets), nixvault (DR copies), nixnas (appliance), and the network peer layer for address resolution | https://git.corbet.ch/corbet-nix/nixshare-corbet-ch.git @ eca4cbd43e25e075565912c43f5adaae1d24b92e |
| storage | nixnas | USB appliance mechanism: boot image, impermanence, generations/rollback, encrypted store geometry, post-boot unlock/import; never creates operator storage | the boot-artifact layer, the delivery and update layer, nixstorage (datasets), nixshare (sharing), nixvault (vault copies) | https://git.corbet.ch/corbet-nix/nixnas.git @ f1c2dcd3417c1ab69c09ec17dd619b3bb298bdf6 |
What success looks like
A person can understand a project from one concise technical page, then meet it
through a distinct showcase designed for discovery and adoption. Both are
compiled from one reviewed project concept. An agent can discover the same
corpus through indexes, structured frontmatter, standard links, raw Markdown,
JSON, RSS, a sitemap, and llms.txt. A failed or uncertain safety check
publishes nothing and leaves the last-known-good site online.